HIGH | JUNE 10, 2026 | CVE-2026-41856
Description
The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies.
This can be an issue if such annotations are used for authorization decisions.
Spring for GraphQL application are vulnerable when all the following are true:
- the application has Spring Security on the classpath
- the application relies on Spring Security's
@EnableMethodSecurityfeature for security checks - the application is implementing
@Controllerclasses within type hierarchies
When all the conditions above are met, the security annotations can be ignored at runtime.
Affected Spring Products and Versions
Spring for GraphQL:
- 2.0.0 - 2.0.3
- 1.4.0 - 1.4.5
- 1.3.0 - 1.3.8
- 1.0.0 - 1.0.6
Versions that are no longer supported are also affected.
Mitigation
Users of affected versions should upgrade to the corresponding fixed version.
| Affected version(s) | Fix version | Availability |
|---|---|---|
| 2.0.x | 2.0.4 | OSS |
| 1.4.x | 1.4.6 | OSS |
| 1.3.x | 1.3.9 | Commercial |
| 1.0.x | 1.0.7 | Commercial |
No further mitigation steps are necessary.
Credit
This vulnerability was discovered and responsibly reported by Bofei Chen.
References
History
- 2026-06-10: Initial vulnerability report published.
Reporting a vulnerability
To report a security vulnerability for a project within the Spring portfolio, see the Security Policy